> > Well YOUR message didn't trigger the minimum, but who knows what the
> > spam would have scored.
>
> Actually the Spam message looks a great deal like the Real McCoy. To
> the untrained eye, it is a Phisher used to Capture Account information.
>
> > Remember, a nonspam message quoting spam is not the same thing as a
> > spam itself.. The headers are different, and the changes to the body
> > text both drop the bayes score considerably.
> >
> >
> OK so the message didn't trigger as SPAM. I need to figure out how to
> detect the Phisher, and ALWAYS trigger the SPAM sensor.
I think you are missing the point here. You are quoting one line from the
phish message that happens to be the bogus url. That is good for a few
points from SURBL or the like.
However, the WHOLE MESSAGE, with headers, could quite possibly trigger quite
a bunch of rules, even if the body text looks virtually correct. Its been
my experience that the headers will trip up a phish about 95% of the time,
without ever looking at the body of the message at all.
Loren
